Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I'm currently (cold) reviewing the sulog of a Solaris box and one of my colleagues asserts that if I see a line that ends in user1-root, therefore user1 has access to the root password.
I suspect that this could actually be the result of user1 calling sudo su root and inputting their own password. I have no live system to test this on, so I'm wondering if someone could confirm my suspicion.
The alternative is that sudo su root will result in a log line ending in root-root.
Which version of Solaris? The reason I ask, is that with v11, root is a role by default. In v11, there is also a feature to allow the user to authenticate to the role with their password to allow for not having a password for the role and/or group account with RBAC ( roleauth=user ). Which means, root might not even have a password to know on Solaris 11.
So the answer depends.
I believe the entry in the sulog would look the same whether they know or don't know the password for the account/role. If you want to know if they called su or sudo, you could ask the user, or check the audit logs. But I'd hope a privileged account was being managed, and that this is an academic type question.
On a Solaris 10 test system, I get myuserid-root in the sulog with sudo su root instead of root-root, as I half-expected. Apparently su is capturing SUDO_USER if/when it is set. According to truss, su's environment has both LOGNAME and USER set to root when it goes to write to sulog; SUDO_USER is the only value with myuserid.
su and/or sudo isn't using environment variables as identifying data in log entries. When you run under truss, do you see any possible calls to any name services? Can you run it under dtrace and capture all user-space function calls?
Jan 25, 2017 at 10:27